Access to/Sharing of Personal Health Information (PHI) and the Use of Health Home Consents #HH0009

  • Policy is also available in Portable Document Format (PDF)

Policy Title: Access to/Sharing of Personal Health Information (PHI) and the Use of Health Home Consents
Policy number: HH0009
Effective date: August 1, 2018
Last revised: April 5, 2019
Approved by:                     Date:

Applicable to: This policy pertains to adults and children eligible for enrollment/ continued enrollment in the Health Home Program.

Upon the effective date, this policy replaces any information provided in Medicaid Updates and guidance webinars posted on the Department of Health's Health Home website related to this subject matter.

Purpose
The New York State Department of Health (the Department) is responsible to assure that Health Homes (HH) have policies and procedures in place that provide clear guidance and expectations regarding the use of Health Home consents for both adults and children. Policies and procedures must include identification of key Federal (HIPAA) and State regulations that govern access to/release of Protected Health Information (PHI) and safeguards to ensure the security and proper use of member PHI for the purpose of coordinating care. The sharing of an enrolled HH member's PHI means a timely and coordinated effort that begins with the CANS-NY (for children), the comprehensive assessment, and the subsequent development of a person-centered plan of care and serves to prevent the potential for duplication of services. Health Home Care Managers (HHCM) must assure members are informed about the importance of information sharing, the type and degree of information being shared, and the member's right to limit the sharing of information between entities. In addition, enrolled members must be provided with information on where to file a complaint if s/he feels their PHI was used without their permission.

Enrollment in the Health Home Program is voluntary. An individual's decision to/not to enroll is documented through completion of applicable HH consent(s). Consent form(s) document the member's approval for accessing and sharing Protected Health Information (PHI) between specified entities named in the consent (e.g., HH, CMA, Medicaid Managed Care Plan (Plan), healthcare providers, family and other supports, etc.).

Consents also provide a method for documenting member choice related to continued enrollment and the member's approval of changes in healthcare providers, non-healthcare services, personal supports and others throughout the member's enrollment in the Health Home program.

Scope
HHs must assure that CMA staff are informed, trained and maintain responsibility for the processes identified in this policy. Members and their parent/guardian/legally authorized representative, Plan, healthcare providers, service agencies, and other entities approved by the member are included in the process.

Health Home Consent Forms
HHs must assure New York State Department of Health authorized and numbered consents are used and completed correctly.

The following chart lists the Health Home consents described in this policy. Each of the consents serves a specific purpose and includes any variances for use between adults and children.

Form Number Form Title Used For:
DOH-5055 Health Home Patient Information Sharing Consent
  • Adults
  • Children/adolescent 18 years of age or older, or child/adolescent under age 18 if they are a parent, pregnant or married and able to self-consent
FAQ Health Home Consent Frequently Asked Questions For Use with Children and Adolescents Under 18 Years of Age
  • Children/adolescents under age 18 who are not a parent, pregnant and/or married and cannot self-consent and need a parent, guardian or legally authorized representative to consent
DOH-5201 Health Home Consent Information Sharing For Use with Children and Adolescents Under 18 Years of Age
DOH-5203 Health Home Consent Information Sharing of Educational Records
DOH 5204 Health Home Consent Withdrawal of Release of Educational Records For All Individuals in Health Home Program

Protected Health Information (PHI)
The Office for Civil Rights enforces the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which protects the privacy of individually identifiable health information; the HIPAA Security Rule, which sets national standards for the security of electronic protected health information; the HIPAA Breach Notification Rule, which requires covered entities and business associates to provide notification following a breach of unsecured protected health information; and, the confidentiality provisions of the Patient Safety Rule, which protect identifiable information being used to analyze patient safety events and improve patient safety.

For information related to HIPAA Privacy Rules, refer to The Office for Civil Rights.

HH are required by law to report any PHI breach as per the HIPAA Breach Notification Rule, 45 CFR §§ 164. 400-414 which can be accessed on the US Department of Health and Human Services website.

Additionally, as per the Data Use Agreement (DUA), HHs are required to report any PHI breach involving a HH member that occurs within the HH or its network providers to the NYS DOH Bureau of Security and Privacy at: doh.sm.Medicaid.Data.Exchange@health.ny.gov

HHs must assure that enrolled members are provided with information on where to file a complaint if s/he feels their PHI was used without their permission (refer to information contained within Health Home consent forms (DOH-5055, DOH-5201, and FAQ document).

Procedures
HH policies and procedures must include the use of consent forms specific to activities related to enrollment, continued enrollment, and disenrollment and address protections related to PHI.

Policies and procedures must include, but are not limited to the following:

  1. compliance with all state and federal laws, DOH guidance documents, and HH policy related to consents to prevent unauthorized access and sharing of PHI;
  2. appropriate DOH-numbered form(s) must be used. NOTE: Forms can be entered into the EHR as long as the document is not altered in any way and the integrity and specific wording/language of the form is unchanged.
  3. address processes to update consents and assure consents remain on file (for example when a member who could not previously self-consent can now self-consent such as when a child turns 18 years of age, or become pregnant, married, or a parent);
  4. address and document any limitations/restrictions set by the member regarding the sharing of PHI, and the use of agency-specific HIPAA compliant consent forms to document such limitations, where applicable. For example: member wants daughter listed as emergency contact but has not given her access to other specified information;
  5. assure member rights are addressed during the signing of consent. Individual(s) signing consent (member and/or designee) must fully understand the content and intended use: e.g., voluntary enrollment; the sharing of (PHI) to support the provision of HHCM services; the development of a plan of care and establishment of a care team (multidisciplinary team) approved by the member; ability to update consent information; etc. (For HHSC, the required FAQ and documentation that the FAQ was reviewed with the parent/guardian/legally authorized representative accomplishes ensuring the understanding of the signed consent forms);
  6. consideration must be given to using forms in the language most suitable for the member with regard for limited English Proficiency (LEP), cultural competency, physical limitations, etc. ;
  7. offer and provide a copy of the completed and signed consent form(s) to the member;
  8. maintain completed and signed consents in the member's record, or document why a required consent or parts of consent were not completed;
    • NOTE FOR HHSC: If DOH-5201-Section 2 cannot be completed, the HHCM must follow documentation requirements listed in Part B below - #4 - DOH-5201 Health Home Consent Enrollment and Information Sharing For Use with Children Under 18 Years of Age, which includes the use and completion of the Health Home Care Management Tracker For Section 2.
  9. assure a system is in place for HHs to obtain information from their CMAs to support the transfer of consent information into the MAPP-HHTS.
    • The MAPP-HHTS must be used to document the presence of consent and sharing of information (PHI) for adults and children accordingly upon enrollment, throughout the duration of enrollment (e.g., when a new consent is signed), and upon disenrollment. Information related to consent must be accessible via MAPP-HHTS at any time for auditing purposes.
      Important to Note: The DOH 5055 and the DOH-5201 are each designed as a consent document that combines both enrollment and sharing of PHI into one form.
    • When a situation warrants that a member's segment in MAPP-HHTS ends the HH must correctly update consent information as appropriate. Consent information may be carried forward when a new segment is created if the initial consent has remained in place and is unchanged.
  10. document and act upon any member-approved changes to the consent in a timely manner, and assure entities involved in the member's care team are informed;
  11. a system must be in place to assure communication between CMA and HH occurs when a member is enrolled/denied enrollment/disenrolled to support issuance of a Notice of Determination. Refer to: Health Home Notices of Determination and Fair Hearing policy#HH0004 under: Eligibility.
  12. CM core services must not be billed without an appropriately completed and signed consent; and,
  13. define actions to be taken to report a violation of PHI as per State and Federal laws, and HH policy.

    Note regarding AOT:
    Policy must include procedures for obtaining consent for individuals enrolled in the Health Home Program under court-ordered Assisted Outpatient Treatment (AOT).

    AOT and HH+ are specific to adult Health Homes. Children and adolescent being served in HHSC that have an AOT order must be served by an appropriate AOT CMA and in the HH+ program, therefore transferred to an adult Health Home.

Sections A-B to follow identify the various Health Home consent forms and describe their use in relation to enrollment, continued enrollment, and disenrollment, as appropriate.

A. Health Home Enrollment/Continued Enrollment
When the HH/CMA confirms an individual meets all appropriate eligibility criteria for enrollment into the Health Home Program, and the individual chooses to enroll, appropriate consent must be obtained to complete the enrollment process. HHCMs must confirm the member's understanding of what they are consenting to, and that signing consent confirms the member' choice to enroll and approval to access/share PHI (DOH-5055 or DOH-5201) with entities approved by the member. HHs must be sure that individuals understand that without a signed consent, enrollment cannot occur or continue.

Consent must include, at a minimum, the following:

  • the name of the CMA, and
  • member's Plan if applicable, and
  • primary care physician and/or healthcare provider from whom the member receives the majority of care (e. g. mental health, substance use, etc.). This includes the healthcare professional treating the chronic condition(s) identified for enrollment of the member into the HH if such professional is someone other than the primary care physician.

Consent guides the process for establishing and maintaining the member's care team and identifies, to what extent each entity may be given access to sharing member PHI. As a 'living document', consent may change over time to include new healthcare providers, service agencies, family and supports, etc. The member must be informed about the importance of including additional providers, services, supports and others to provide a greater level of care and support to the member in meeting his/her goals. Evidence of such changes must be documented in the member's consent, minimizing the potential for misuse of PHI.

Forms used for enrollment/continued enrollment are as follows:

1. DOH-5055 Health Home Patient Information Sharing Consent
The DOH-5055 is used to enroll/maintain enrollment for HH members who are adult, children/adolescent 18 years of age or older, or child/adolescent under age 18 if they are a parent, pregnant or married and able to self-consent.

When completing the form, page 3is used to list healthcare providers, family/supports and other entities approved by the member and given full access to PHI and integrated into all aspects of the member's plan of care.

Note regarding limitations on information sharing:

While completing this consent form, a member must be informed of the various means through which his/her health information may be accessed by the HH and assigned CMA/HHCM. These include: Statewide Health Information Network for New York (SHIN-NY), The Psychiatric Services and Clinical Enhancement System (PSYCKES); TABS/CHOICES (run by the New York State Office for People With Developmental Disabilities OPWDD), and the Single Point of Access under the authority of the Local Government Unit (SPOA/LGU).

While completing the required Health Home consent form, if the member requests limited access to/sharing of PHI with certain approved entities, for example: between selected healthcare providers; for non-healthcare agencies/services; and, for the member's 'emergency contact', the HHCM must assure these entities are documented on a separate HIPAA-compliant consent form to be maintained with the completed and signed HH consent form in the member's record. This alternate form can be provided by the CMA or by the agency requesting the information. The document must clearly reflect the member's choice, define the information to be accessed/shared, identify the purpose, indicate if time limited, etc.

The process must include appropriate means of communicating limitations between entities as appropriate to the situation.

Options for completing DOH-5055, page 3

If using a blank page 3:

In addition to listing the CMA, member's Plan, and the member's primary care physician or healthcare provider from whom the member receives the majority of care reflective of the chronic condition for which the member was enrolled in a Health Home (e. g. behavioral health, substance use, etc.), the HHCM must:

  • list any other healthcare providers (e.g., hospital, etc.) approved by the member for whom full access has been given must be clearly indicated. It is appropriate to also list family or significant other(s) for whom the member has authorized full access.

If using pre-listed HH network partners on page 3:

In addition to listing the CMA, member's Plan, and the member's primary care physician or healthcare provider from whom the member receives the majority of care reflective of the chronic condition for which the member was enrolled in a Health Home (e. g. behavioral health, substance use, etc.), the HHCM must clearly identify entities approved by the member as follows:

  • place a check mark ( ✓ ) next to every entity approved by the member; OR,
  • cross out (---) all entities except those that the member has approved; AND,
  • have the member (or consenter) and HHCM initial and date next to each entity approved by the member.

IMPORTANT

HHCMs must assure that members are not asked to approve an entire pre-filled network list in anticipation of an entity possibly being needed in the future. Consent must clearly identify only those entities approved by the member directly involved in the member's care team/plan of care at the time of signing and updating consent to align with member choice and protect the member's PHI.

Health Homes must continuously monitor and assure proper protocols are being followed to complete the DOH-5055 and address any issues identified to prevent potential for misuse of member PHI.

2. FAQ Health Home Consent Frequently Asked Questions (FAQ) For Use with Children Under 18 Years of Age

A child/adolescent under age 18, and the parent, guardian or legally authorized representative must be provided a copy of Health Home Consent Frequently Asked Questions (FAQ) For Use with Children Under 18 Years of Age which explains the Health Home program and services, and consent for information sharing and Health Home enrollment. The form must be reviewed with the child/adolescent and the parent, guardian, or legally authorized representative prior to completing and signing the DOH-5201, which contains statements confirming that the FAQ document was reviewed and understood by the child and their parents, guardians, or legally authorized representatives.

Note for the Health Home Serving Children's (HHSC) program:

Children who are parents, pregnant, and/or married, and who otherwise capable of consenting, should not be given this document. Instead, they should be given the DOH-5055 Health Home Patient Information Sharing Consent form to review and complete.

3. DOH-5201 Health Home Enrollment and Information Sharing For Use with Children Under18 Years of Age

The DOH-5201 is completed for children/adolescents under age 18 who are not a parent, pregnant and/or married. This form outlines what, and with whom the child/adolescent's health information can be shared.
NOTE: The use of auto-filling providers in Section 1 and Section 2 is not acceptable.

The DOH-5201 has two sections, which must be completed as follows:

Section 1:
To be completed only by the Parent, Guardian or Legally Authorized Representative of children under the age of 18. The Parent, Guardian, or Legally Authorized Representative should be informed that:

  • Health providers may share information from before or after the signature date on the consent form.
  • Consent to share information can be recorded, modified and withdrawn at any time.
  • The child can keep private any information about services that the
  • child/adolescent has the right to self-consent to receive (see Section 2).

Section 2:
To be completed only by the child/adolescent separately in the presence of the Health Home care manager and not with the parents, guardians, or legally authorized representative. Children must be age 10 and older to complete Section 2 - Part A; age 12 and older for Section 2 - Part B.

  • The child/adolescent can keep private any of their information regarding family planning, emergency contraception, abortion, sexually transmitted infection testing and treatment, HIV testing, treatment and prevention, prenatal care, labor and delivery services, drug and alcohol treatment, or sexual assault services.
  • Section 2 must be completed unless any of the following reasons apply:
    • child does not meet age requirement;
    • permission denied to meeting alone with the child by the parent/guardian/legally authorized representative;
    • child states they are not currently receiving minor protected, and mental health and developmental disabilities services;
    • child is not able/willing to complete.
  • If DOH-5201 Section 2 is NOT completed for any of the reasons listed above, permission has not been granted by the child and therefore, information may NOT be released or shared with providers.
    • The HHCM must document the reason(s) in the member's record and also complete the Health Home Care Management Tracker For Section 2.
    • The HHCM must continue to approach the child as appropriate to complete Section 2 (e.g., child turns 10; child is receiving minor protected, mental health, development disabilities services; child is able/willing; parent/guardian/legally authorized representative gives permission for HHCM to meet alone with child; etc.). All attempts must be documented in the member's record and on the Health Home Care Management Tracker For Section 2.
  • In addition, if child/adolescent is specifically receiving mental health services and is over the age of twelve, the mental health provider may ask the child/adolescent if they want their information disclosed.
  • If the parent, guardian, or legally authorized representative consented for these services or is aware of the of these services (mentioned above) on behalf of the child/adolescent, then the parent, guardian, or legal authorized representative may have the authority to consent for the release of information for these services. However, the child/adolescent must also consent to their lease of this information.

Once the DOH-5201 is in place, an additional consent form must be signed that allows for access to information needed to support the development of the member's plan of care, as follows:

4. DOH-5203 Health Home Consent Release of Educational Records
The DOH-5203 is for consent to release educational records to a Health Home for children and adolescents who have been enrolled in a Health Home, if the child/adolescent is enrolled in school. It includes information on what educational records and with whom educational records can be shared. Consent for release of educational records for children and adolescents under age 18 must be provided by the parent as defined in Question 5 of the DOH-5203. Consent for release of educational records for those aged 18 and over must be provided by the individual.

New York State Education (NYSED) requires a different consent to release educational records because they are covered by Family Educational Rights and Privacy Act (FERPA) and not the Health Insurance Portability and Accountability Act (HIPAA). The definition of parent in DOH-5203 is also different from other Health Home consent forms. Please refer to DOH-5203 for the complete definition of parent, guardian or legally authorized representative.

Note: This will also include education records that are directly related to an infant or toddler in the Early Intervention Program (EIP) or records from a local early intervention official.

Obtaining the DOH-5203 does not impact the enrollment process. However, HHCMs must discuss completion of this form with the member or parent, guardian or legally authorized representative, and document any instances where this consent is not signed and the reason. The HHCM must attempt to secure consent by approaching the member or parent, guardian or legally authorized representative at a later time.

NOTE: For more in-depth information regarding the Health Home Serving Children's (HHSC) consent forms, please reference the HHSC Consent Form Guidance document - HHSC Consent Forms and Templates

Updating Consent
Consents must be updated when there is a change in: healthcare provider, family/consenter, significant other(s) or supports; emergency contact; service agency; care management agency; the member's Plan; Behavioral Health Organization (BHO); etc. This includes updates needed to any other HIPAA compliant forms also on file for the member.

Note for HHSC: In addition, when a child turns ten years of age, DOH-5201 Section 2 should be revisited with the child (if s/he has the ability to answer Section 2 questions - refer to DOH-5201, Section 2 above, including completion and use of the Health Home Care Management Tracker For Section 2).

HHCMs must notify appropriate entities regarding changes made to the consent to maintain continuity of care and assure proper protections for the use of the member's PHI.

When updating consent with the member, the HHCM must assure the same method is used each time to prevent any confusion and potential misuse of PHI (e.g., for the DOH 5055, if Option 1 was used to complete consent for enrollment, then Option 1 must be used whenever any changes to consent occur).

REMEMBER: All changes to consent must be dated and initialed by both the member (or consenter) and the HHCM.

HHCMs must review the member's consent(s) at least annually with the member to assure it is accurate and reflects up-to-date information regarding the member's selection and address any needed updates. The member's consent should also be reviewed when the comprehensive assessment and/or the plan of care is being updated or when there is a significant life event that occurs with the members, or when new providers are referred or involved and/or the member/Parent/Guardian/Legally Authorized Representative requests a change, as it is at these times when additional providers and or information regarding the member will be needed by the HHCM.

Note: In addition, when a child turns ten years of age, DOH-5201 Section 2 should be revisited with the child (if s/he has the ability to answer Section 2 questions - refer to DOH-5201 Section 2 above, including use of the Health Home Care Management Tracker For Section 2, as appropriate).

B. Disenrollment from the Health Home Program
When an enrolled HH member voluntarily chooses to disenroll from the HH program, the CMA/HHCM must take all steps necessary to complete the disenrollment process to end the member's enrollment and the sharing of member PHI and other pertinent information (e.g., educational records). HHs must assure that policies and procedures include, but are not limited to the following:

  1. The HHCM must provide written confirmation to the enrolled member to assure understanding of the intent to disenroll from the Health Home Program and end consent to share PHI (or other pertinent information), the effective date, how to obtain records/documents, and information on requesting consideration for re-enrollment in the future. The HHCM must document this information including the issuance of the written notification in the member's record.
  2. The HHCM must assure that the member's care team is notified of the disenrollment date making certain that access to/sharing of PHI ceases, as appropriate.

    Additional information related to member disenrollment can be found:
    • Member Disenrollment From the Health Home Program #HH0007

Forms used to disenroll HH members are described as follows:

  1. DOH 5204 - Withdrawal of Release of Educational Records
    The DOH 5204 is used to withdraw consent to release educational records (which includes Early Intervention Program records) for children and adolescents who have been enrolled in a HH. In addition to the time of disenrollment from the Health Home program, a request to withdraw a release of educational records can occur at any time during the child/adolescent's enrollment. Withdrawal of consent for release of educational records for children under age 18 must be provided by the parent, guardian or legally authorized representative. Withdrawal of consent for release of educational records for those aged 18 and over must be provided by the individual.

C. When a New Consent Must Be Obtained
There are situations that warrant the completion of a new consent form(s). HH/CMAs must assure that the correct consent form(s) is completed and signed by the member, and that providers and others listed in the consent form are notified accordingly. Reasons for obtaining new consent include, but are not limited to when the following occurs:

  • if the child/adolescent turns 18 years old, only if he/she did not previously consent for him/herself;
  • if the child/adolescent changes from foster care to non-foster care or non-foster care to foster care;
  • if the child/adolescent under age 18 gets married, becomes pregnant or becomes a parent;
  • the consenter for children under 18 years of age changes;
  • the child changes schools/districts (refers to use of DOH-5203 for HHSC);
  • if the member re-enrolls in the Health Home program following disenrollment; or,
  • if a member changes Health Homes;
  • if a Health Home has changes in its structure and/or network: Certain structure/ network changes may result in the need for a new Health Home consent to be signed by enrolled members. HHs must follow the guidelines as defined in the "Requirements and Instructions For Using the Notification of Change Form" document, which can be accessed via the Department's Lead Health Home Resource Center webpage - under: Administrative Requirements for Health Homes (see: Notification of Change Form)

Note: When a new consent form is needed due to the circumstances listed above, the new consent form to enroll and information sharing MUST occur within the month of the event, to ensure continuity of care management services and the ability to bill for such services.

Note: When the member changes Health Homes, record sharing is not an automatic process. Member consent must be obtained by the CMA/HH to allow for the transfer of member records from current to receiving HH to assure PHI is protected in the process. If new consent is not obtained at the time of transfer, then it must be completed no later than the member's next review cycle or, if there is a change that requires consent updates (e. g. providers, services, or others requested and approved by the member).

D. Acceptable Practices for Obtaining Signatures
In addition to signing consent via wet signature (ink on paper) the practice of obtaining member signature via electronic means is acceptable as long as Health Homes and Care Management Agencies are in compliance with all applicable New York State and Federal laws.

Consent forms may be provided to and received back from members/consenters, completed and signed either in person, via regular mail, through email/scan or fax, or through other secured electronic means.

Refer to the following links:

E. Training
Health Homes must assure that policies and procedures related to training for staff on the subject of PHI and Consent include, but are not limited to the following:

  1. familiarity with the various laws and requirements for adults and children associated with consent;
  2. the use, purpose, and completion of Health Home consents for adults and children;
  3. protection of PHI, and agency specific and DOH required reporting protocols for HHs and CMAs; and,
  4. how to engage members regarding the various consents and obtaining the appropriate signatures, and provider information for the HHCM to assist the member with quality care management to in meeting the member's health and wellness needs.

F. Quality Monitoring
HH must evaluate patterns of use for Health Home consents within its network and establish Quality Monitoring activities to address any issues identified.

HH must assure quality monitoring activities are in place and include, but are not limited to:

  1. enrollments that did not occur due to refusal by individuals to sign consent;
  2. individuals that chose to opt out of HH program enrollment;
  3. members were enrolled in the presence of a correctly completed and signed consent form(s);
  4. updates to consent were made correctly and timely upon changes in providers, services, and others approved by the member and/or Parent, Guardian/Legally Authorized Representative, etc.;
  5. proper notification to member's care team to cease sharing of information upon the member's disenrollment, as appropriate;
  6. timely notification to Health Home at member disenrollment for distribution of NODs;
  7. identification of violations in management of PHI, immediate actions taken to report a violation of PHI as per state and federal laws and HH policy, actions taken to correct the violation and prevent reoccurrence.

Relevant Statutes

  • Federal regulations for Health Information Portability and Accountability Act (HIPAA) 42 CFR 431. 302, 42 CFR Part 2
  • Health Information Portability and Accountability Act (HIPAA) 45 CFR Parts 160, 162 and 164
  • Privacy and security of personally identifiable information 45 CFR 155. 260
  • New York State Social Services Law Section 369 (4), Section367b(4)
  • New York Mental Hygiene Law Section 33. 13 and 33. 16
  • Social Security Act, 42 USC 1396a(a)(7)
  • New York Public Health Law Article 27-F
  • Family Educational Rights and Privacy Act (FERPA) 34 CFR Part 99
  • 10 NYCRR Part 300 - Statewide Health Information Network for New York (SHIN-NY);
  • NY Mental Hygiene Laws 41. 05, 41. 07 and 41. 13

References
Additional information about Health Home Consents and PHI and other information referenced in this policy can be accessed on the DOH Health Home website via the following links: